Line: 321 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	/* uuid from PSM */
	u8 uuid[16];
	/* same size as task_struct .comm[], command that opened context */
	char comm[TASK_COMM_LEN];
	/* Bitmask of in use context(s) */
	DECLARE_BITMAP(in_use_ctxts, HFI1_MAX_SHARED_CTXTS);
	/* per-context event flags for fileops/intr communication */
	unsigned long event_flags;
	/* A page of memory for rcvhdrhead, rcvegrhead, rcvegrtail * N */

            

Line: 20 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	skb->protocol = *((__be16 *)data);

	dst_data = skb_put(skb, size);
	memcpy(dst_data, data, size);
	skb->mac_header = HFI1_IPOIB_PSEUDO_LEN;
	skb_pull(skb, HFI1_IPOIB_ENCAP_LEN);
}

static struct sk_buff *prepare_frag_skb(struct napi_struct *napi, int size)

            

Line: 696 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              int hfi1_ipoib_txreq_init(struct hfi1_ipoib_dev_priv *priv)
{
	struct net_device *dev = priv->netdev;
	char buf[HFI1_IPOIB_TXREQ_NAME_LEN];
	unsigned long tx_ring_size;
	int i;

	/*
	 * Ring holds 1 less than tx_ring_size

            

Line: 231 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
		if (!new_dlist)
			return;
		memcpy(new_dlist, vc4_state->dlist, vc4_state->dlist_count * 4);

		kfree(vc4_state->dlist);
		vc4_state->dlist = new_dlist;
		vc4_state->dlist_size = new_size;
	}

            

Line: 106 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
	/* Save the user's BO pointer, so we don't stomp it with the memcpy. */
	state->bo = get_state->bo;
	memcpy(get_state, state, sizeof(*state));

	bo_state = kcalloc(state->bo_count, sizeof(*bo_state), GFP_KERNEL);
	if (!bo_state) {
		ret = -ENOMEM;
		goto err_free;

            

Line: 204 Column: 14 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	return -wc - 1;
}

static const char *sc_type_names[SC_MAX] = {
	"kernel",
	"ack",
	"user",
	"vl15"
};

            

Line: 1457 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	for (i = 0; i < ARRAY_SIZE(phy_clocks); i++) {
		struct clk_fixed_factor *fix = &dsi->phy_clocks[i];
		struct clk_init_data init;
		char clk_name[16];
		int ret;

		snprintf(clk_name, sizeof(clk_name),
			 "dsi%u_%s", dsi->variant->port, phy_clocks[i].name);


            

Line: 107 Column: 14 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

               * D4..7 select from 15 choices, translated by table:
 */
#define QSFP_MOD_TECH_OFFS 147
extern const char *const hfi1_qsfp_devtech[16];
/* Active Equalization includes fiber, copper full EQ, and copper near Eq */
#define QSFP_IS_ACTIVE(tech) ((0xA2FF >> ((tech) >> 4)) & 1)
/* Active Equalization includes fiber, copper full EQ, and copper far Eq */
#define QSFP_IS_ACTIVE_FAR(tech) ((0x32FF >> ((tech) >> 4)) & 1)
/* Attenuation should be valid for copper other than full/near Eq */

            

Line: 84 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
struct vbox_connector {
	struct drm_connector base;
	char name[32];
	struct vbox_crtc *vbox_crtc;
	struct {
		u32 width;
		u32 height;
		bool disconnected;

            

Line: 495 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		}
		child_dev_ptr = dev_priv->child_dev + count;
		count++;
		memcpy((void *)child_dev_ptr, (void *)p_child,
					sizeof(*p_child));
	}
	return;
}